vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

change the syscall callback initialization scope

Browse source
This commit is contained in:
sina 2025-06-08 00:06:52 +02:00
parent 664e84a14f
commit bdfd1f30eb
No known key found for this signature in database
4 changed files with 26 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

14
hyperdbg/hyperevade/code/Transparency.c
View file

@ -54,15 +54,6 @@ TransparentHideDebugger(HYPEREVADE_CALLBACKS * Hyperevade
&TransparentModeRequest->SystemCallNumbersInformation,
sizeof(SYSTEM_CALL_NUMBERS_INFORMATION));
//
// Initialize the syscall callback mechanism from hypervisor
//
if (!g_Callbacks.SyscallCallbackInitialize())
{
TransparentModeRequest->KernelStatus = DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER;
return FALSE;
}
//
// Choose a random genuine vendor string to replace hypervisor vendor data
//
@ -103,11 +94,6 @@ TransparentUnhideDebugger(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * Transpar
//
g_TransparentMode = FALSE;
//
// Unitialize the syscall callback mechanism from hypervisor
//
g_Callbacks.SyscallCallbackUninitialize();
TransparentModeRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
return TRUE;
}

26
hyperdbg/hyperhv/code/interface/HyperEvade.c
View file

@ -30,12 +30,13 @@ TransparentHideDebuggerWrapper(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * Tra
//
//
// Fill the callbacks for using hyperlog in VMM
// Fill the callbacks for using hyperlog in hyperevade
// We use the callbacks directly to avoid two calls to the same function
//
// HyperevadeCallbacks.LogCallbackPrepareAndSendMessageToQueueWrapper = LogCallbackPrepareAndSendMessageToQueue;
HyperevadeCallbacks.LogCallbackSendMessageToQueue = LogCallbackSendMessageToQueue;
HyperevadeCallbacks.LogCallbackSendBuffer = LogCallbackSendBuffer;
HyperevadeCallbacks.LogCallbackCheckIfBufferIsFull = LogCallbackCheckIfBufferIsFull;
HyperevadeCallbacks.LogCallbackPrepareAndSendMessageToQueueWrapper = g_Callbacks.LogCallbackPrepareAndSendMessageToQueueWrapper;
HyperevadeCallbacks.LogCallbackSendMessageToQueue = g_Callbacks.LogCallbackSendMessageToQueue;
HyperevadeCallbacks.LogCallbackSendBuffer = g_Callbacks.LogCallbackSendBuffer;
HyperevadeCallbacks.LogCallbackCheckIfBufferIsFull = g_Callbacks.LogCallbackCheckIfBufferIsFull;
//
// Memory callbacks
@ -54,8 +55,14 @@ TransparentHideDebuggerWrapper(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * Tra
//
HyperevadeCallbacks.SyscallCallbackSetTrapFlagAfterSyscall = SyscallCallbackSetTrapFlagAfterSyscall;
// SYSCALL_CALLBACK_INITIALIZE SyscallCallbackInitialize;
// SYSCALL_CALLBACK_UNINITIALIZE SyscallCallbackUninitialize;
//
// Initialize the syscall callback mechanism from hypervisor
//
if (!SyscallCallbackInitialize())
{
TransparentModeRequest->KernelStatus = DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER;
return FALSE;
}
//
// Call the hyperevade hide debugger function
@ -72,5 +79,10 @@ TransparentHideDebuggerWrapper(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * Tra
BOOLEAN
TransparentUnhideDebuggerWrapper(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * TransparentModeRequest)
{
//
// Unitialize the syscall callback mechanism from hypervisor
//
SyscallCallbackUninitialize();
return TransparentUnhideDebugger(TransparentModeRequest);
}

7
hyperdbg/hyperhv/header/hooks/SyscallCallback.h
View file

@ -74,6 +74,13 @@ typedef struct _SYSCALL_CALLBACK_TRAP_FLAG_STATE
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
BOOLEAN
SyscallCallbackInitialize();
BOOLEAN
SyscallCallbackUninitialize();
BOOLEAN
SyscallCallbackSetTrapFlagAfterSyscall(GUEST_REGS * Regs,
UINT32 ProcessId,

14
hyperdbg/include/SDK/modules/HyperEvade.h
View file

@ -72,18 +72,6 @@ typedef BOOLEAN (*MEMORY_MAPPER_WRITE_MEMORY_SAFE_ON_TARGET_PROCESS)(UINT64 Dest
*/
typedef PCHAR (*COMMON_GET_PROCESS_NAME_FROM_PROCESS_CONTROL_BLOCK)(PVOID Eprocess);
/**
* @brief A function that initializes the syscall callback
*
*/
typedef BOOLEAN (*SYSCALL_CALLBACK_INITIALIZE)();
/**
* @brief A function that uninitializes the syscall callback
*
*/
typedef BOOLEAN (*SYSCALL_CALLBACK_UNINITIALIZE)();
/**
* @brief A function that sets the trap flag after a syscall
*
@ -131,8 +119,6 @@ typedef struct _HYPEREVADE_CALLBACKS
//
// System call callbacks
//
SYSCALL_CALLBACK_INITIALIZE SyscallCallbackInitialize;
SYSCALL_CALLBACK_UNINITIALIZE SyscallCallbackUninitialize;
SYSCALL_CALLBACK_SET_TRAP_FLAG_AFTER_SYSCALL SyscallCallbackSetTrapFlagAfterSyscall;
} HYPEREVADE_CALLBACKS, *PHYPEREVADE_CALLBACKS;